Serverless Schools - Thoughts, Tips and the Reality!

[Mr.Ben]

So I thought so would start a thread on this, as it seems many of us are beginning to think of moving more services to the cloud.

 

I'm the ICT Manager for a large Multi Academy Trust in the South West (32 schools).

 

First off, I have to admit that these are all primary, and therefore we don't have many of the more complicated systems that Secondaries have. We moved to Scholarpack around 5 years ago which removes all of the on premises requirements of SIMS, and until Capita actually release SIMS primary in a form that is useful we don't have a reason to look at anything else.

 

Recently I have moved our smallest and largest schools to be 'Serverless' (One as a trial and one out of necessity based upon a server failure).

 

We used a combination of Intune, Office 365 and a product called Printix to achieve this.

 

I'll answer as many questions as you come up with and detail more of my thoughts later.

[XiJ]

Interested in this as we’re looking at moving an academy trust to server less.

 

Which machines to do you manage with Intune - windows or iPads too?

 

What hardware do you have on-site (any storage, small Servers etc?)

[DrBeaker]

Serverless? Still seems to be a bit of a con sometimes IMHO.

 

e.g. with Adobe CC, they put the price up - if you still want to use it, you have to pay the price.

 

How's that going to be any different with other cloud service providers etc as the years go on? If you want to move providers what about the egress charges? It all comes down to the SPoF is the Internet connection and the bandwidth of it. We know how far behind the UK is in terms of broadband infrastructure compared to other countries.

[mbedford]

Serverless? Still seems to be a bit of a con sometimes IMHO.

 

e.g. with Adobe CC, they put the price up - if you still want to use it, you have to pay the price.

 

How's that going to be any different with other cloud service providers etc as the years go on? If you want to move providers what about the egress charges? It all comes down to the SPoF is the Internet connection and the bandwidth of it. We know how far behind the UK is in terms of broadband infrastructure compared to other countries.

 

I agree completely with the pricing concerns. See this article from a few years back

 

https://www.theregister.co.uk/2016/10/24/microsoft_price_rises/

 

Yes, staying on prem also means you are facing an increase (13% vs 22%) at least that is more in your control (you can choose cheaper hardware, not refresh, decrease offering....)

 

Mike

[Mr.Ben]

Interested in this as we’re looking at moving an academy trust to server less.

 

Which machines to do you manage with Intune - windows or iPads too?

 

What hardware do you have on-site (any storage, small Servers etc?)

Hardware wise we have a mix of legacy switches and WiFi, but not even a small server on site. DHCP is currently managed from the sites router and my intent is to move this to a central point in the trust network when we consolidate all of the schools onto a single provider. DNS is configured directly with the provider.

 

For the initial schools we have started with just Windows PCs but fully intend to migrate the iPads away from the legacy Meraki implementations.

 

We are already managing our Trust Android phones with Intune.

 

Key to this is the fact that the bulk of our schools have been well trained in using SharePoint, so there is less friction from users with migrating old file shares to SharePoint.

 

I'm using Known Folder Redirection (KFM) for Intune to redirect Document, Desktop and Pictures to OneDrive for 1-1 devices.

[Mr.Ben]

I agree completely with the pricing concerns. See this article from a few years back

 

https://www.theregister.co.uk/2016/10/24/microsoft_price_rises/

 

Yes, staying on prem also means you are facing an increase (13% vs 22%) at least that is more in your control (you can choose cheaper hardware, not refresh, decrease offering....)

 

Mike

Yup, prices go up. It is a fact of life, and something that should be budgeted for at 4%.

 

You can still sweat the assets - Anything up to 7 years old is running Windows 10 now. Any equipment not W10 capable isn't appropriate to be teaching with and the end of W7 support is now so near those devices will be retired.

 

We pay for our OVS-ES Desktop pack and EMS v3 which allows us to secure our Office 365 implementation the the standards that GCHQ recommend for public services. Unless we are deciding to move over to Linux anytime soon we will still be buying OVS for some time, regardless of pricing increases.

 

Bear in mind that our primaries are replacing servers every 5-6 years, assume a cost of £9k for that including the cost of technicians, power for the lifespan, petrol and at least a return visit once a year.

 

That saving is going to be re-invested into the broadband infrastructure. A 100Mbs leased line is roughly 4.5k per annum for us, copper FTTC is around £2.5k

[XiJ]

Hardware wise we have a mix of legacy switches and WiFi, but not even a small server on site. DHCP is currently managed from the sites router and my intent is to move this to a central point in the trust network when we consolidate all of the schools onto a single provider. DNS is configured directly with the provider.

 

For the initial schools we have started with just Windows PCs but fully intend to migrate the iPads away from the legacy Meraki implementations.

 

We are already managing our Trust Android phones with Intune.

 

Key to this is the fact that the bulk of our schools have been well trained in using SharePoint, so there is less friction from users with migrating old file shares to SharePoint.

 

I'm using Known Folder Redirection (KFM) for Intune to redirect Document, Desktop and Pictures to OneDrive for 1-1 devices.

 

Thanks. Yes share point would be the big one and we want to involve all staff from the planning stages so everyone is on board.

 

Did you consider Microsoft 365 for licensing?

[Mr.Ben]

I have and will move to this once our 2016 OVS expires (the pricing on this is low in comparison to this year's pricing). It is also likely that we will love the EES next year, which should bring the licensing in at around £48 per head

[Achandler]

Until MS/ Google etc increase your pricing and you have no option but to pay.

 

If I was going server less (which I'm not as I don't work in schools any more), I would base my costs on halfway between commercial and education minimum when comparing because like all the as a service products out there, they exist for one reason only, to get a guaranteed income for companies for a cheaper cost to them as well. So increase profits.

 

It's been seen in the past, the provider updates something, breaks something then takes months to fix it while you still pay the same cost. You can't roll things back yourself.

[FN-GM]

Its something I have been looking at and it will be possible to cloud most things.

 

One thing I can't find a cloud replacement for is an imaging - I think we will still need a local on site server for imaging large amount of machines. Whilst we still use Windows this will be a requirement.

[DrCheese]

Aye, until/if PCs get something similar to Mac's built in system restore tool that works even if the hard drive has been replaced. As the PC is an open platform it'll be difficult to move towards that tho.

[Arthur]

One thing I can't find a cloud replacement for is an imaging - I think we will still need a local on site server for imaging large amount of machines. Whilst we still use Windows this will be a requirement.

Doesn't Windows Autopilot solve the imaging issue (since you don't need to image the PC)?

 

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

[Arthur]

until/if PCs get something similar to Mac's built in system restore tool that works even if the hard drive has been replaced. As the PC is an open platform it'll be difficult to move towards that tho.

When PCs support PXE booting via HTTP that should be possible.

 

https://2pintsoftware.com/uefi-2-5-hardware-starts-ship-http-pxe-coming/

 

In theory an OEM could host a boot image on a publicly accessible web server that allows you to restore Windows.

[TechMonkey]

Aye, until/if PCs get something similar to Mac's built in system restore tool that works even if the hard drive has been replaced. As the PC is an open platform it'll be difficult to move towards that tho.

 

This would be a dream but in reality I fear it would be a nightmare as every manufacturer did their own slightly different implementation. We can but hope.

 

Currently we have set up MDT on it's own VLAN and any laptop we image gets put through that and AutoPilot picks it up. Not perfect but it is an acceptable compromise.

 

@Arthur - The issue is if you want a custom WIM, or if you need to completely flatten the PC in the middle of its life. Or replace the HDD. From our playing AutoPilot is only OK if you are happy shipping a device direct to a user, them turning it on and having everything from the OEM image their with your controls and policies overlaid.

Edited March 12, 2019 by TechMonkey

[Jcx500]

Went to a demo on this , potentially it could it is tied closely with intune

[mavhc]

Well, you turn on the device, restore it to the standard windows wim using Fresh Start, and then autopilot it. MS suggest that you could remove the OEM stuff automatically, without reinstalling, but hah.

 

Let's say it dl's 4GBs per computer, that's 5 mins at 100Mbps, so about 10 computers an hour

[supportman]

Very interesting, we've been moving further and further away from internal servers to the point where my server rack is looking rather empty!

 

Feels great but the Onsite Domain Controllers, MIS and web filtering are all areas I would love to move offsite.

 

Shame I don't have a primary school to test out on

 

How do you find Windows Intune? Has it evolved much since the early days?

 

I would of though chromebooks were also an option.

[Mr.Ben]

Just to answer the question on how we are doing imaging, we are using a combination of Autopilot and Provisioning profiles on usb sticks.

 

Autopilot is only of use with devices with TPM chips, I still have far too many without his for the time being and I wanted a consistent approach. I've used it for our central team's devices.

 

For these first couple of schools, I have 20 usb sticks with 1809 and unattended xml file that means I don't have to interact with them until Cortana pops up, then pop a usb in with the provisioning profile, wait 10 seconds and move onto the next device. The whole process per device takes 15 minutes (if it has an SSD) and around 2 minutes of hands on time per device.

 

I have thought of have a WDS/MDT server to take into schools to deploy the base image (might be a little quicker).

 

I'm working on pulling back the autopilot data at the moment automatically, which would mean after the initial image we would be able to reset a device remotely - the staff member connects it to an open provisioning network and it recieves the appropriate certificates and reconnects to the internal network (The provisioning network is managed by mac address at the moment).

 

I personally don't think it's that big a deal to ask a staff member to connect the device to a network, if the alternative is spending a large sum on support cost (think 2 hours of driving plus 30 minutes on site for each re-image - our geographic area is huge).

[Mr.Ben]

Very interesting, we've been moving further and further away from internal servers to the point where my server rack is looking rather empty!

 

Feels great but the Onsite Domain Controllers, MIS and web filtering are all areas I would love to move offsite.

 

Shame I don't have a primary school to test out on

 

How do you find Windows Intune? Has it evolved much since the early days?

 

I would of though chromebooks were also an option.

 

I think the last 6 months of Intune development have been huge. I can now deploy Exe's, MSI's and Store apps, a few hundred group policy settings have made it into profiles (under 'Administrative Templates') and loads more W10 only settings (you have to resign yourself to the fact W7 and W8 are poorly supported).

 

The bits I can see being troublesome at the moment are tracking updates (I may revert from update rings to a cloud based WSUS server in the near future to have more control). I'm still pondering that, but updates seem to be being deployed - most machines have already picked up all of the security updates.

[supportman]

I think the last 6 months of Intune development have been huge. I can now deploy Exe's, MSI's and Store apps, a few hundred group policy settings have made it into profiles (under 'Administrative Templates') and loads more W10 only settings (you have to resign yourself to the fact W7 and W8 are poorly supported).

 

Wow! I went to a Microsoft event years ago and they were talking about ditching group policy and moving to windows intune, sounds like they have finally started to make that happen.

 

Its a sensible move, I really like where Microsoft are going these days. Great company finally getting its act together.

[mavhc]

Wow! I went to a Microsoft event years ago and they were talking about ditching group policy and moving to windows intune, sounds like they have finally started to make that happen.

 

Its a sensible move, I really like where Microsoft are going these days. Great company finally getting its act together.

 

By throwing away the stuff that works and doesn't cost me anything and only working on things I have to pay for monthly?

[localzuk]

I'm still not convinced. We've gone for a slightly different approach. Centralised servers. Soon, only our central site will have any servers - all our other schools are connected by PTP leased line fibres, and make use of our central cluster.

[mavhc]

All servers are centralised, just central to what, the room, the building, the city, the country, the world?

 

Where you put the server depends on the users, if they're all over the world, put your server in the world, if they're just on one site, put the server on the site.

 

What we do need is different words for the computer and the software. Can we just say computer instead of physical server machine?

 

"I'm renting some computers from Google" vs "I bought 3 computers to run servers on"

[Mr.Ben]

I'm still not convinced. We've gone for a slightly different approach. Centralised servers. Soon, only our central site will have any servers - all our other schools are connected by PTP leased line fibres, and make use of our central cluster.

 

Don't get me wrong, I'm not convinced either, this is a trial and will need adjustments.

 

However I also (as primary only) don't have the existing infrastructure to build upon, and 30 schools require a lot of resilience. I would expect to be looking at £150K at a minimum to centralise with a backup site, plus build two appropriate server rooms.

 

The ongoing costs of maintaining that infrastructure then need to be taken into account, along with power (£400 per server per annum, backup and the quicker connections that are required for the backhauled/centralised approach.

 

All on primary budgets.

[mavhc]

My server says it's using 80 Watts, that's 700 kWh, so £100 in power per year